Commit 77b9d059 authored by Nick Piggin's avatar Nick Piggin Committed by Jens Axboe

writeback: Fix bdi use after free in wb_work_complete()

By the time bdi_work_on_stack gets evaluated again in bdi_work_free, it
can already have been deallocated and used for something else in the
!on stack case, giving a false positive in this test and causing
corruption.
Signed-off-by: default avatarNick Piggin <npiggin@suse.de>
Signed-off-by: default avatarJens Axboe <jens.axboe@oracle.com>
parent 77fad5e6
...@@ -113,6 +113,7 @@ static void bdi_work_free(struct rcu_head *head) ...@@ -113,6 +113,7 @@ static void bdi_work_free(struct rcu_head *head)
static void wb_work_complete(struct bdi_work *work) static void wb_work_complete(struct bdi_work *work)
{ {
const enum writeback_sync_modes sync_mode = work->args.sync_mode; const enum writeback_sync_modes sync_mode = work->args.sync_mode;
int onstack = bdi_work_on_stack(work);
/* /*
* For allocated work, we can clear the done/seen bit right here. * For allocated work, we can clear the done/seen bit right here.
...@@ -120,9 +121,9 @@ static void wb_work_complete(struct bdi_work *work) ...@@ -120,9 +121,9 @@ static void wb_work_complete(struct bdi_work *work)
* to after the RCU grace period, since the stack could be invalidated * to after the RCU grace period, since the stack could be invalidated
* as soon as bdi_work_clear() has done the wakeup. * as soon as bdi_work_clear() has done the wakeup.
*/ */
if (!bdi_work_on_stack(work)) if (!onstack)
bdi_work_clear(work); bdi_work_clear(work);
if (sync_mode == WB_SYNC_NONE || bdi_work_on_stack(work)) if (sync_mode == WB_SYNC_NONE || onstack)
call_rcu(&work->rcu_head, bdi_work_free); call_rcu(&work->rcu_head, bdi_work_free);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment